by Kastro
Paper/Archive/CVE-2024-9932

CVE-2024-9932

jurredeklijn Wux Blog Editor — Wux Blog Editor <= 3.0.0 - Unauthenticated Arbitrary File Upload

EPSS 37%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 98.5.985 × 2019.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The Wux Blog Editor plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'wuxbt_insertImageNew' function in versions up to, and including, 3.0.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Affected

ProductAffectedFixed inSource
Wux Blog Editor≤ 3.0.0–CNA
wux_blog_editor≤ 3.0.0–CISA-ADP

Scores by source

Wordfence (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refwordfence.com/threat-intel/vulnerabilities/id/c2c0ab2d-1ba9-4a0a-b1fa-bacebe1034eb?source=cverefplugins.trac.wordpress.org/browser/wux-blog-editor/tags/3.0.0/External_Post_Editor.php#L675refgithub.com/JoshuaProvoste/0-click-RCE-Exploit-for-CVE-2024-9932